Threat reportVulnerabilityTL-2026-3483
Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks (37 vulnerabilities patched, 7 critical; fixed in Chrome 155.0.8059.79)
Multiple Google Chrome Flaws Could Enable Memory Corruption (TL-2026-3483) is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-10-14 and last reviewed 2026-10-15. It has no confirmed attribution, affects Google Chrome, references 16 CVEs (CVE-2026-110152, CVE-2026-110149, CVE-2026-110136), maps to 6 MITRE ATT&CK techniques (T1068, T1189, T1203), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9.6/10Critical
- CVEs
- 16Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-3483
- Threat ID
- TL-2026-3483
- Severity
- CRITICAL
- CVSS
- 9.6
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all sectors, government administration, finance, health, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
- Updates
- 2026-10-15 · 2 updates · revalidated 2× · latest source
How Multiple Google Chrome Flaws Could Enable Memory Corruption works
Google patched 37 Chrome vulnerabilities (7 critical, 29 high, 1 medium), mostly memory-corruption flaws (use-after-free, buffer overflow) across ANGLE, Browser, PDF, Network, Core, SVG, Media, V8 and other components. Chrome versions before 155.0.8059.79 are affected; no in-the-wild exploitation is confirmed and the CVEs checked are not in CISA KEV.
On 2026-10-13 Google released a Chrome Stable channel update to 155.0.8059.79/.80 (Windows/Mac) and 155.0.8059.79 (Linux) that fixes 37 security vulnerabilities: 7 rated Critical, 29 High and 1 Medium, as reported by Cyber Security News on 2026-10-14.
The seven Critical flaws are CVE-2026-110152 (ANGLE, buffer overflow, credited to Zhenpeng 'Leo' Lin of depthfirst), and use-after-free bugs in Browser (CVE-2026-110149), PDF (CVE-2026-110136), Network (CVE-2026-110161), Core (CVE-2026-110165), SVG (CVE-2026-110148) and Media (CVE-2026-110151), each credited to Google / Xinyang Ge. NVD describes CVE-2026-110152 as a heap-based buffer overflow (CWE-122) in ANGLE in Chrome on Android prior to 155.0.8059.79 that could allow a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
Notable High-severity issues include CVE-2026-110169 (V8 use-after-free, reported by Xinyang Ge of Anthropic, assisted by Claude; a crafted HTML page could allow a remote attacker to execute arbitrary code inside Chrome's sandbox), CVE-2026-110166 (Animation, buffer overflow) and CVE-2026-110155 (PDFium, buffer overflow). Only 9 of the 37 CVE IDs were retrievable from the sources; the remaining high-severity CVEs were not extracted.
No CVSS scores were published at the time of research, no public PoC and no in-the-wild exploitation were reported, and CVE-2026-110169 is not listed in CISA KEV. No network or file IOCs exist for this vulnerability batch, so BeaconBeagle correlation was not applicable. Defenders should update Chrome and Chromium-based browsers to 155.0.8059.79 or later.
MITRE ATT&CK techniques used in TL-2026-3483
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
Execution
T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link; T1204.002 User Execution
Defense Evasion
Affected products and versions in Multiple Google Chrome Flaws Could Enable Memory Corruption
- Google — Chrome
Vulnerable versions: < 155.0.8059.79
Fixed in: 155.0.8059.79; 155.0.8059.80 (Windows/Mac)
Remediation for Multiple Google Chrome Flaws Could Enable Memory Corruption
Patches
- Chrome Stable 155.0.8059.79/.80 (Windows/Mac) and 155.0.8059.79 (Linux)
Immediate actions
- Update Google Chrome to 155.0.8059.79 or later (155.0.8059.79/.80 on Windows and Mac, 155.0.8059.79 on Linux)
- Restart the browser to complete the update
Workarounds
- Avoid untrusted websites and crafted HTML content until patched
Longer-term hardening
- Enforce browser auto-update and version compliance through enterprise management policy
- Keep Chromium-based browsers on the same patch cadence as Chrome stable
CVEs associated with Multiple Google Chrome Flaws Could Enable Memory Corruption
Weaknesses (CWE) in Multiple Google Chrome Flaws Could Enable Memory Corruption
Timeline of Multiple Google Chrome Flaws Could Enable Memory Corruption
- Zhenpeng 'Leo' Lin (depthfirst) reported the ANGLE heap buffer overflow, later assigned CVE-2026-110152.
- Reports of the Browser, PDF, Networking, Core, SVG and Media critical use-after-free issues began (reported 2026-10-01 to 2026-10-06 by Google and Xinyang Ge).
- Last of the critical use-after-free reports in the 2026-10-01 to 2026-10-06 reporting window.
- Preceding Chrome 155 stable update (155.0.8059.39 on Linux) shipped on 2026-10-06 with critical use-after-free fixes in Browser and Navigation, per Malwarebytes; the 2026-10-13 build supersedes it.
- NVD published CVE-2026-110152 and CVE-2026-110136 (CVSS 3.1 9.6 Critical) and CVE-2026-110147 (PDF use-after-free, CVSS 8.8 High).
- Chrome for Android 155.0.8059.79 published, fixing the ANGLE heap buffer overflow CVE-2026-110152.
- Coverage states the advisory does not describe a complete attack chain or confirm in-the-wild exploitation of the newly patched flaws.
- Update also fixed CVE-2026-110146 (Passwords information leak), CVE-2026-110150 (Installer privilege elevation) and medium CVE-2026-110142 (FileSystem use-after-free).
- CVE-2026-110169 was not listed in the CISA KEV catalog; no in-the-wild exploitation confirmed.
- Rapid7 recorded CVE-2026-110169, a high-severity V8 use-after-free credited to Xinyang Ge (Anthropic, assisted by Claude); CVSS and EPSS not available.
- NVD published CVE-2026-110152, a critical ANGLE heap buffer overflow (CWE-122) reported by Zhenpeng 'Leo' Lin of depthfirst.
- Google released Chrome Stable 155.0.8059.79/.80 (Windows/Mac) and 155.0.8059.79 (Linux) fixing 37 security vulnerabilities.
- Chrome Releases blog posted an Early Stable Update for Desktop as rollout continued; Microsoft Edge reported as still awaiting its corresponding update.
- Cyber Security News reported the update: 7 critical, 29 high and 1 medium vulnerabilities, mostly memory-corruption flaws.
- Malwarebytes published a user advisory urging Chrome updates; no in-the-wild exploitation or public PoC reported.
Update history for TL-2026-3483
- 2026-10-15 — Google Chrome 155 fixes 37 security flaws including seven Critical (CVE-2026-110152, CVE-2026-110136, CVE-2026-110147): What changed CVSS score unset - 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) per NVD for CVE-2026-110152 and CVE-2026-110136. Severity, exploitability (NONE) and status (PATCHED) unchanged; no exploitation reported. New indicators (3)
- 2026-10-14 — Google Chrome 155 Update Fixes 37 Security Vulnerabilities, Including 7 Critical Flaws (CVE-2026-110152, CVE-2026-110149, CVE-2026-110136): What changed No field changes. Severity (CRITICAL), exploitability (NONE) and status (PATCHED) are unchanged; the report still states there is no confirmed in-the-wild exploitation and no public PoC. New indicators (0) None. The report list
Sources cited for Multiple Google Chrome Flaws Could Enable Memory Corruption
- Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks
- Chrome Releases: Stable Channel Update for Desktop
- Chrome Releases Blog - October 2026 archive
- NVD - CVE-2026-110152
- Rapid7 - Google Chrome CVE-2026-110169
- Malwarebytes - Update Chrome and ChromeOS to fix critical security issues
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-3483
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3483 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.